typofinder

Domain typo finder ドメインタイポ発見のためのTypofinder NCC Group Plc によってオープンソースとして公開 - http://www.nccgroup.com/ 開発者: Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com Stephen Tomkinson, @neonbunny9 on twitter Matt Summers, matt dot summers at nccgroup dot com https://github.com/nccgroup/typofinder...

CVE-2021-42694

CVE-2021-42694 このスクリプトは、同形文字（Homoglyph）検出ツールを実装しており、主にコード内に存在する可能性のある CVE-2021-42694 脆弱性を検出するために使用されます。その主な機能を詳しく説明します： 核心機能： コード内の同形文字置換攻撃を検出 Python ファイル内の変数名、関数名などの識別子をスキャン 視覚的に類似しているが実際には異なる Unicode 文字を識別 主要コンポーネント： HomoglyphDetector クラス：主要な検出器クラス データ取得：Unicode 公式サイトから Confusables データを取得...

uriDeep

uriDeep 基于机器学习的Unicode编码攻击工具。利用混淆字符（confusables）创建惊人虚假域名的机器学习工具。部分域名可欺骗IDN策略（Chrome与Firefox）。 我利用神经网络创建了最佳（大型）混淆字符字典。该字典在工具中使用，可从以下地址下载： https://github.com/mindcrypt/uriDeep/blob/master/data/deepDiccConfusables.txt root@kitploit: mindcrypt@kali:/tool/uriDeep python3 uriDeep.py /\ /\ / \ / / \ \ '...

ditto

Ditto は、ドメイン名を入力として受け取り、ホモグラフ攻撃 のためのすべてのバリアントを生成し、どのドメインが利用可能で、どのドメインが既に登録されているかをチェックする小さなツールです。 PoC ドメイン https://tᴡitter.com/ https://clᴏudflare.com Docker の使用 Docker Hub 上のイメージ はプッシュのたびに更新されます。以下のように実行するだけです。 root@kitploit: docker run evilsocket/ditto -h ソースからのコンパイル ソースからのコンパイルには Go...

huntglyph

huntglyph — ホモグラフ攻撃を検出 ホモグラフ攻撃は、異なる文字体系（例：ラテン文字の「a」とキリル文字の「а」）の文字の視覚的類似性を利用して、ドメイン名、ファイル名、またはその他の識別子を偽装し、ユーザーが正当なソースとやり取りしていると思い込ませるものです。 huntglyph は、これらの欺瞞的な行為を識別するための検出ソリューションを提供し、デジタルセキュリティと明瞭性を確保します。 使用方法 huntglyph は、文字列やファイルを解析するためのいくつかのコマンドを提供します。 text: 生のテキスト文字列を解析...

CVE-2021-42694

CVE-2021-42694 使用最近公布的同形字攻击漏洞生成恶意文件，该漏洞至少已在 C、C++、C、Go、Python、Rust、JS 等语言中发现。 引用自 cve.mitre.org 在 Unicode 规范至 14.0 版的字符定义中发现了一个问题。该规范允许攻击者使用同形字生成源代码标识符（如函数名），这些标识符在视觉上与目标标识符完全相同。攻击者可利用这一点，通过在上游软件依赖项中定义对抗性标识符来注入代码，这些依赖项在下游软件中被欺骗性地调用。 同形字的原始数据（homoglyphs.txt）取自此处，并已清理数据以排除斜体和外观差异较大的字符。 查看剑桥大学的原始来源：...

homoglyphs

IL PROGETTO È ARCHIVIATO Fork: https://github.com/orsinium/forks Homoglyphs Homoglyphs -- libreria Python per ottenere omoglifi e convertirli in ASCII. Caratteristiche È una versione più intelligente di confusablehomoglyphs: Rilevamento automatico o scelta manuale della categoria alias da ISO...

CVE-2026-73420

CVE-2026-73420 affects NextAuth.js email/passwordless flows where the default email normalizer validates addresses before Unicode normalization. An address containing a homoglyph (e.g., U+FF20 FULLWIDTH COMMERCIAL AT) can canonicalize to a normal ASCII @ after NFKC/NFKD, causing downstream mail l...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

CVE-2026-73420 NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

NextAuth.js provides authentication for Next.js. Prior to @auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, the defaultNormalizer used by the email and magic-link sign-in flow validates an address before applying Unicode normalization. An address can contain a Unicode character such as...

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470 Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

CVE-2026-70470

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

GHSA-7RQJ-J65F-68WH Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Summary The default email-address normalizer used by the email/magic-link sign-in flow validates the address before applying Unicode normalization. An address can contain a Unicode character that is not an ASCII @ U+0040 but canonicalizes to one under NFKC/NFKD normalization the normalization...

MAL-2026-4636 Malicious code in peertube-plugin-google-analytics-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c66b6ebad55556f956fbc181293327eb4051d2ec6de6436a24d027fac58e580 This PeerTube plugin advertises itself as a Google Analytics integration but its client-side script client/common-client-plugin.js:8 registers a...

Malicious code in @onerjs/smart-filters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a4578e888bb6e53b7a5df17aa093931f6aff50773efd2634819294538217ab Package is published under the @onerjs scope but self-describes as 'Babylon.js Smart Filter core' with repository metadata pointing at...

CVE-2025-55129

HackerOne community member Kassem S.kassems94 has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne...

CVE-2025-55129

HackerOne community member Kassem S.kassems94 has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the fix for CVE-2025-52672, via several alternate techniques. Homoglyphs based impersonation has been independently reported by other HackerOne...